auth_group權限組管理

一、權限組的表分析

auth_group  ---  是存儲權限分組

auth_permission --- 存放用戶能夠使用那個表

auth_group_permission --- 鏈接權限分組和能使用權限的表

auth_users_group --- 鏈接用戶信息表和權限分組表

 

後臺的功能實現

 

# 在apps/admin/views.py中建立以下類：

class GroupsManageView(View):
    """
    /admin/groups/
    渲染頁面和發送前端展現數據
    """
    def get(self,request):
        groups = Group.objects.values('id','name').annotate(num_users=Count('user')).\
            order_by('-num_users','id')
        return render(request,'admin/user/groups_manage.html',locals())

class GroupsAddView(View):
    """
    /admin/groups/add/
　　增長管理組
    """
    def get(self,request):
        permissions = Permission.objects.only('id').all()
        return render(request,'admin/user/groups_add.html',locals())

    def post(self,request):
        json_data = request.body
        if not json_data:
            return to_json_data(errno=Code.PARAMERR, errmsg=error_map[Code.PARAMERR])
        dict_data = json.loads(json_data.decode('utf8'))

        # 取出組名，進行判斷
        group_name = dict_data.get('name', '').strip()
        if not group_name:
            return to_json_data(errno=Code.PARAMERR, errmsg='組名爲空')

        one_group, is_created = Group.objects.get_or_create(name=group_name)
        if not is_created:
            return to_json_data(errno=Code.DATAEXIST, errmsg='組名已存在')

        # 取出權限
        group_permissions = dict_data.get('group_permissions')
        if not group_permissions:
            return to_json_data(errno=Code.PARAMERR, errmsg='權限參數爲空')

        try:
            permissions_set = set(int(i) for i in group_permissions)
        except Exception as e:
            logger.info('傳的權限參數異常：\n{}'.format(e))
            return to_json_data(errno=Code.PARAMERR, errmsg='權限參數異常')

        all_permissions_set = set(i.id for i in Permission.objects.only('id'))
        if not permissions_set.issubset(all_permissions_set):
            return to_json_data(errno=Code.PARAMERR, errmsg='有不存在的權限參數')

        # 設置權限
        for perm_id in permissions_set:
            p = Permission.objects.get(id=perm_id)
            one_group.permissions.add(p)

        one_group.save()
        return to_json_data(errmsg='組建立成功！')

class GroupsEditView(View):
    """
    /admin/groups/<int:group_id>/
　　更新管理的權限
    """
    def get(self,request,group_id):
        group = Group.objects.filter(id=group_id).first()
        if group:
            permissions = Permission.objects.only('id').all()
            return render(request,'admin/user/groups_add.html',locals())
        raise Http404('須要更新的組不存在!')

    def delete(self, request, group_id):
        group = Group.objects.filter(id=group_id).first()
        if group:
            group.permissions.clear()   # 清空權限
            group.delete()
            return to_json_data(errmsg="用戶組刪除成功")
        else:
            return to_json_data(errno=Code.PARAMERR, errmsg="須要刪除的用戶組不存在")

    def put(self,request,group_id):
        group = Group.objects.filter(id=group_id).first()
        if not group:
            return to_json_data(errno=Code.NODATA, errmsg='須要更新的用戶組不存在')

        json_data = request.body
        if not json_data:
            return to_json_data(errno=Code.PARAMERR, errmsg=error_map[Code.PARAMERR])
        # 將json轉化爲dict
        dict_data = json.loads(json_data.decode('utf8'))

        # 取出組名，進行判斷
        group_name = dict_data.get('name', '').strip()
        if not group_name:
            return to_json_data(errno=Code.PARAMERR, errmsg='組名爲空')

        if group_name != group.name and Group.objects.filter(name=group_name).exists():
                return to_json_data(errno=Code.DATAEXIST, errmsg='組名已存在')

        # 取出權限
        group_permissions = dict_data.get('group_permissions')
        if not group_permissions:
            return to_json_data(errno=Code.PARAMERR, errmsg='權限參數爲空')

        try:
            permissions_set = set(int(i) for i in group_permissions)
        except Exception as e:
            logger.info('傳的權限參數異常：\n{}'.format(e))
            return to_json_data(errno=Code.PARAMERR, errmsg='權限參數異常')

        all_permissions_set = set(i.id for i in Permission.objects.only('id'))
        if not permissions_set.issubset(all_permissions_set):
            return to_json_data(errno=Code.PARAMERR, errmsg='有不存在的權限參數')

        existed_permissions_set = set(i.id for i in group.permissions.all())
        if group_name == group.name and permissions_set == existed_permissions_set:
            return to_json_data(errno=Code.DATAEXIST, errmsg='用戶組信息未修改')
        # 設置權限
        for perm_id in permissions_set:
            p = Permission.objects.get(id=perm_id)
            group.permissions.add(p)
        group.name = group_name
        group.save()
        return to_json_data(errmsg='組更新成功！')


class UsersManageView(View):
    """
    /admin/users/
　　用戶的權限
    """
    def get(self,request):
        users = Users.objects.only('username', 'is_staff', 'is_superuser').filter(is_active=True)
        return render(request, 'admin/user/users_manage.html', locals())

class UsersEditView(View):
    """
    /admin/users/<int:user_id>/
　　設置用戶權限
    """
    def get(self,request,user_id):
        user_instance = Users.objects.filter(id=user_id).first()
        if user_instance:
            groups = Group.objects.only('name').all()
            return render(request, 'admin/user/users_edit.html', locals())
        else:
            raise Http404('須要更新的用戶不存在！')

    def put(self,request,user_id):
        user_instance = Users.objects.filter(id=user_id).first()
        if not user_instance:
            return to_json_data(errno=Code.NODATA, errmsg='須要更新的用戶不存在')

        json_data = request.body
        if not json_data:
            return to_json_data(errno=Code.PARAMERR, errmsg=error_map[Code.PARAMERR])
        # 將json轉化爲dict
        dict_data = json.loads(json_data.decode('utf8'))

        # 取出參數，進行判斷
        try:
            groups = dict_data.get('groups')    # 取出用戶組列表

            is_staff = int(dict_data.get('is_staff'))
            is_superuser = int(dict_data.get('is_superuser'))
            is_active = int(dict_data.get('is_active'))
            params = (is_staff, is_superuser, is_active)
            if not all([p in (0, 1) for p in params]):
                return to_json_data(errno=Code.PARAMERR, errmsg='參數錯誤')
        except Exception as e:
            logger.info('從前端獲取參數出現異常：\n{}'.format(e))
            return to_json_data(errno=Code.PARAMERR, errmsg='參數錯誤')

        try:
            groups_set = set(int(i) for i in groups) if groups else set()
        except Exception as e:
            logger.info('傳的用戶組參數異常：\n{}'.format(e))
            return to_json_data(errno=Code.PARAMERR, errmsg='用戶組參數異常')

        all_groups_set = set(i.id for i in Group.objects.only('id'))
        if not groups_set.issubset(all_groups_set):
            return to_json_data(errno=Code.PARAMERR, errmsg='有不存在的用戶組參數')

        gs = Group.objects.filter(id__in=groups_set)
        # 先清除組
        user_instance.groups.clear()
        user_instance.groups.set(gs)

        user_instance.is_staff = bool(is_staff)
        user_instance.is_superuser = bool(is_superuser)
        user_instance.is_active = bool(is_active)
        user_instance.save()
        return to_json_data(errmsg='用戶信息更新成功！')

    def delete(self, request, user_id):
        user_instance = Users.objects.filter(id=user_id).first()
        if user_instance:
            user_instance.groups.clear()    # 清除用戶組
            user_instance.user_permissions.clear()  # 清除用戶權限
            user_instance.is_active = False  # 設置爲不激活狀態
            user_instance.save()
            return to_json_data(errmsg="用戶刪除成功")
        else:
            return to_json_data(errno=Code.PARAMERR, errmsg="須要刪除的用戶不存在")

 

admin登陸繼承 LoginRequiredMixin

admin登陸權限繼承 PermissionRequiredMixinfrom django.contrib.auth.mixins import LoginRequiredMixin,PermissionRequiredMixinclass IndexView(LoginRequiredMixin,View)"""    create admin index view    /admin/

""" # login_url = 'users:login' # 沒有權限就重寫到這個 redirect_field_name = 'next' # 登陸成功轉到的頁面 def get(self,request): return render(request,'admin/index/index.html') class TagManageView(PermissionRequiredMixin,View): """ route: /admin/tags/`` """ permission_required = ('news.add_tag','news.view_tag') # news是數據庫所在的app名稱，add或view爲權限表中增刪改查的一種，tag爲表名稱 raise_exception = True # 默認的報錯信息 def handle_no_permission(self): # 繼承錯誤返回方法,這個類視圖get和post返回的方法不一樣 if self.request.method.lower() != 'get': # 若是是get沒有權限 返回 return to_json_data(errno=Code.ROLEERR, errmsg='沒有操做權限')
 else: 
 return super(TagManageView,self).handle_no_permission() # post請求沒有權限發送默認錯誤 super(所在的類，self)
 class TagEditView(PermissionRequiredMixin,View): # 這個類視圖是有get和put方法,只返回json
 """  /admin/tags/<int:tag_id>/ """ permission_required = ('news.delete_tag','news.change_tag') raise_exception = True def handle_no_permission(self): return to_json_data(errno=Code.ROLEERR, errmsg='沒有操做權限')

 

 

 

 

 # 繼承錯誤返回方法,這個類視圖是有get和post方法的

# post請求沒有權限發送默認錯誤